Multiline graph over time

It looks like you really just need to look at the elapsed time field of the *_END fields for this - based on the observation that field is null for the other events, and your filters aggregation only uses the *_END fields.

The way you would do this in a Line Chart is very similar to what you did for the pie chart, except there is a Date Histogram aggregation that makes time buckets for a regular interval of dates.

Thanks to your mapping and the sample data, I made a date histogram line chart that I think does what you're looking for:

Sorry, the data I indexed is not very continuous so it segments all over the place. Hopefully this conveys the idea though.

1 Like